Started Getting Lots of 1003 Events with Stop Errors - What is Cau

T

Travis

Error code 0000000a, parameter1 cc2c2b1c, parameter2 d0000002, parameter3
00000000, parameter4 8080f5b6.

Error code 0000000a, parameter1 00000005, parameter2 d0000002, parameter3
00000000, parameter4 8080f5db.

Error code 1000007e, parameter1 c0000005, parameter2 f7b9b93c, parameter3
b63b8c30, parameter4 b63b892c.

When these occur the server just reboots. I have looked at the minidumps
and those aren't telling me much. Please Help.

Travis
 
T

Travis

RE: Started Getting Lots of 1003 Events with Stop Errors - What is

Pretty Please!!! I need some help.
 
J

John John

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or
bad RAM. If you enable and run Driver Verifier you may find more
information. Disable the Automatically Reboot on failure option and
after you enable Verifier reboot the machine and see if it gives you a
BSOD and a driver file name. As for the Event ID 1003, what is the
source of the error?

John

Travis wrote:

> Pretty Please!!! I need some help.
>
 
T

Travis

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

Thank you so much for responding!!

1. How do I run Driver Verifier.
2. The Source is System Error, Category is (102).
3. I am going to take the server down tonight if it makes it that far and
run some diags on the RAM and other hardware. I was thinking about doing a
chkdsk /f as well.

Any other ideas?

"John John" wrote:

> My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or
> bad RAM. If you enable and run Driver Verifier you may find more
> information. Disable the Automatically Reboot on failure option and
> after you enable Verifier reboot the machine and see if it gives you a
> BSOD and a driver file name. As for the Event ID 1003, what is the
> source of the error?
>
> John
>
> Travis wrote:
>
> > Pretty Please!!! I need some help.
> >
>
>
 
T

Travis

Here is a redout of one of the minidump files - different everytime though.
Iw ill psot the others too.

1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 808f8157, The address that the exception occurred at
Arg3: b4668bc0, Exception Record Address
Arg4: b46688bc, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlUpcaseUnicodeToOemN+709
808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

EXCEPTION_RECORD: b4668bc0 -- (.exr 0xffffffffb4668bc0)
ExceptionAddress: 808f8157 (nt!RtlUpcaseUnicodeToOemN+0x00000709)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0000002c
Attempt to read from address 0000002c

CONTEXT: b46688bc -- (.cxr 0xffffffffb46688bc)
eax=00000000 ebx=e51606a8 ecx=00004b36 edx=000001c8 esi=000000c8 edi=86d90798
eip=808f8157 esp=b4668c88 ebp=b4668cd0 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!RtlUpcaseUnicodeToOemN+0x709:
808f8157 83782c14 cmp dword ptr [eax+2Ch],14h
ds:0023:0000002c=00000000
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 0000002c

BUGCHECK_STR: 0x7E

EXCEPTION_STR: 0x0

LAST_CONTROL_TRANSFER: from 808ea1b0 to 808f8157

STACK_TEXT:
b4668cd0 808ea1b0 86d90798 00000001 00000001 nt!RtlUpcaseUnicodeToOemN+0x709
b4668d04 8080fca9 86d90798 b4668d3c 808a3ff0 nt!PspQueryQuotaLimits+0x5c
b4668d40 808127a2 86cc7b98 808ae5c0 8a393298 nt!CcExtendVacbArray+0x9
b4668d80 8088043d 8a393298 00000000 86cc7b98 nt!FsRtlFastCheckLockForRead+0x3a
b4668dac 80949b7c 8a393298 00000000 00000000 nt!VerifierIrqlData+0x3d
b4668ddc 8088e062 80880352 80000000 00000000 nt!CmpPrefetchHiveFile+0x4e
b4668e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


FOLLOWUP_IP:
nt!RtlUpcaseUnicodeToOemN+709
808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlUpcaseUnicodeToOemN+709

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

STACK_COMMAND: .cxr 0xffffffffb46688bc kb

FAILURE_BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

Followup: MachineOwner
---------
 
M

Mathieu CHATEAU

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

Hello,

How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617/en-us

Download:
http://www.microsoft.com/whdc/DevTools/tools/DrvVerifier.mspx


--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


"Travis" <Travis@discussions.microsoft.com> wrote in message
news:46FE9750-678A-497E-8A80-1CD3AF821CCE@microsoft.com...
> Thank you so much for responding!!
>
> 1. How do I run Driver Verifier.
> 2. The Source is System Error, Category is (102).
> 3. I am going to take the server down tonight if it makes it that far and
> run some diags on the RAM and other hardware. I was thinking about doing
> a
> chkdsk /f as well.
>
> Any other ideas?
>
> "John John" wrote:
>
>> My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or
>> bad RAM. If you enable and run Driver Verifier you may find more
>> information. Disable the Automatically Reboot on failure option and
>> after you enable Verifier reboot the machine and see if it gives you a
>> BSOD and a driver file name. As for the Event ID 1003, what is the
>> source of the error?
>>
>> John
>>
>> Travis wrote:
>>
>> > Pretty Please!!! I need some help.
>> >
>>
>>
 
T

Travis

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

Here's another:
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: cc2c2b1c, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 8080f5b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: cc2c2b1c

CURRENT_IRQL: d0000002

FAULTING_IP:
nt!CcGetBcbListHeadLargeOffset+13c
8080f5b6 ?? ???

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8080f5b6 to 8088c963

STACK_TEXT:
f78dac1c 8080f5b6 badb0d00 00000000 87b58bf8 nt!FsRtlNotifyCleanup+0x47
f78dacfc 8080fc56 8864a224 00000000 00000001
nt!CcGetBcbListHeadLargeOffset+0x13c
f78dad40 808127a2 8a394660 808ae5c0 8a3880b0 nt!CcReferenceFileOffset+0x5c
f78dad80 8088043d 8a3880b0 00000000 8a394660 nt!FsRtlFastCheckLockForRead+0x3a
f78dadac 80949b7c 8a3880b0 00000000 00000000 nt!VerifierIrqlData+0x3d
f78daddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e
f78dae84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcGetBcbListHeadLargeOffset+13c
8080f5b6 ?? ???

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

SYMBOL_NAME: nt!CcGetBcbListHeadLargeOffset+13c

FAILURE_BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

Followup: MachineOwner
---------
 
T

Travis

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

And another - all of these are within yesterday and today:
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000005, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 8080f5db, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000005

CURRENT_IRQL: d0000002

FAULTING_IP:
nt!CcGetVacbLargeOffset+1d
8080f5db ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8080f5db to 8088c963

STACK_TEXT:
f78d2c1c 8080f5db badb0d00 00000000 8a1bb7a0 nt!FsRtlNotifyCleanup+0x47
f78d2cfc 8080fc56 899cee2c 00000000 00000001 nt!CcGetVacbLargeOffset+0x1d
f78d2d40 808127a2 8a394b40 808ae5c0 8a3911e0 nt!CcReferenceFileOffset+0x5c
f78d2d80 8088043d 8a3911e0 00000000 8a394b40 nt!FsRtlFastCheckLockForRead+0x3a
f78d2dac 80949b7c 8a3911e0 00000000 00000000 nt!VerifierIrqlData+0x3d
f78d2ddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e
f78d2e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcGetVacbLargeOffset+1d
8080f5db ?? ???

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

SYMBOL_NAME: nt!CcGetVacbLargeOffset+1d

FAILURE_BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

Followup: MachineOwner
---------
 
T

Travis

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

Excellent - I will give this a go when I take the machein down later today.
 
T

Travis

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

Alos, I too thought of remving the checkmark so it doesn't auto-reboot.
Hopefully that will make it so I see the BSOD nest time it happens.
 
J

John John

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

http://msdn2.microsoft.com/en-us/library/ms792872.aspx

If you get a BSOD when you reboot gather the BSOD information, then you
will have to use the Last Known Good or Safe Mode boot to gain access to
the machine again, where you can then disable Verifier.

As for the Event 1003 see if you can find anything in here:
http://www.eventid.net/display.asp?eventid=1003&eventno=1274&source=System&phase=1

John

Travis wrote:

> Thank you so much for responding!!
>
> 1. How do I run Driver Verifier.
> 2. The Source is System Error, Category is (102).
> 3. I am going to take the server down tonight if it makes it that far and
> run some diags on the RAM and other hardware. I was thinking about doing a
> chkdsk /f as well.
>
> Any other ideas?
>
> "John John" wrote:
>
>
>>My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or
>>bad RAM. If you enable and run Driver Verifier you may find more
>>information. Disable the Automatically Reboot on failure option and
>>after you enable Verifier reboot the machine and see if it gives you a
>>BSOD and a driver file name. As for the Event ID 1003, what is the
>>source of the error?
>>
>>John
>>
>>Travis wrote:
>>
>>
>>>Pretty Please!!! I need some help.
>>>
>>
>>
 
You must log in or register to reply here.

Similar threads

H
Server resets (restarts) every few days (after blue screen)
Replies
3
Views
215
Dave Patrick
D
J
System Failure: Stop error Reason Code: 0x805000f
Replies
9
Views
673
Newell White
N
J
Server failing and rebooting
Replies
3
Views
316
Steve
S
M
Help with a stop message
Replies
1
Views
333
John Toner [MVP]
J
R
System crash - Event ID 1003
Replies
3
Views
118
rkwilcox
R
Back
Top Bottom